@moon-x/core 0.2.0

package/dist/index.js

@@ -0,0 +1,402 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  FORWARDED_ERROR_FIELDS: () => FORWARDED_ERROR_FIELDS,
+  Network: () => Network,
+  PostMessageClient: () => PostMessageClient,
+  PostMessageMethod: () => PostMessageMethod,
+  PostMessageServer: () => PostMessageServer,
+  PostMessageType: () => PostMessageType,
+  WALLET_ERROR_CODES: () => WALLET_ERROR_CODES,
+  WalletCreationError: () => WalletCreationError,
+  getIframeOrigin: () => getIframeOrigin,
+  getIframeUrl: () => getIframeUrl,
+  getMoonKeyApiUrl: () => getMoonKeyApiUrl
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/types/wallet.ts
+var WALLET_ERROR_CODES = {
+  WALLET_NOT_CONNECTED: "WALLET_NOT_CONNECTED",
+  USER_REJECTED: "USER_REJECTED",
+  INVALID_MESSAGE: "INVALID_MESSAGE",
+  INVALID_TRANSACTION: "INVALID_TRANSACTION",
+  NETWORK_ERROR: "NETWORK_ERROR",
+  UNKNOWN_ERROR: "UNKNOWN_ERROR"
+};
+
+// src/types/index.ts
+var WalletCreationError = /* @__PURE__ */ ((WalletCreationError2) => {
+  WalletCreationError2["SESSION_INVALID"] = "Session is invalid - cannot create wallet";
+  WalletCreationError2["FAILED_TO_CREATE_WALLET"] = "Failed to create wallet";
+  return WalletCreationError2;
+})(WalletCreationError || {});
+var Network = /* @__PURE__ */ ((Network2) => {
+  Network2["Bitcoin"] = "bitcoin";
+  Network2["Solana"] = "solana";
+  Network2["Ripple"] = "ripple";
+  Network2["Ethereum"] = "ethereum";
+  Network2["Polygon"] = "polygon";
+  Network2["Arbitrum"] = "arbitrum";
+  Network2["Optimism"] = "optimism";
+  Network2["Base"] = "base";
+  Network2["ZkSync"] = "zksync";
+  Network2["BinanceSmartChain"] = "bsc";
+  Network2["Tron"] = "tron";
+  return Network2;
+})(Network || {});
+
+// src/utils/get-api-url.ts
+var getMoonKeyApiUrl = () => {
+  if (process.env?.NEXT_PUBLIC_MOONKEY_API_URL) {
+    return process.env.NEXT_PUBLIC_MOONKEY_API_URL;
+  }
+  if (process.env?.NEXT_PUBLIC_MOONKEY_IFRAME_URL) {
+    const iframeUrl = process.env.NEXT_PUBLIC_MOONKEY_IFRAME_URL;
+    if (iframeUrl.includes("staging") || iframeUrl.includes("auth-staging")) {
+      return "https://api.moonx-dev.com";
+    }
+  }
+  if (process.env?.NEXT_PUBLIC_VERCEL_ENV === "preview") {
+    return "https://api.moonx-dev.com";
+  }
+  return "https://api.moonx-dev.com";
+};
+
+// src/utils/get-iframe-url.ts
+var DEFAULT_IFRAME_PROJECT_NAME = "moonx-wallet-iframe";
+var joinUrl = (baseUrl, path) => {
+  if (!path) return baseUrl;
+  const normalizedBase = baseUrl.replace(/\/$/, "");
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  return `${normalizedBase}${normalizedPath}`;
+};
+var withBypass = (url) => {
+  const bypass = process.env.NEXT_PUBLIC_VERCEL_PROTECTION_BYPASS;
+  if (!bypass) return url;
+  const separator = url.includes("?") ? "&" : "?";
+  return `${url}${separator}x-vercel-protection-bypass=${bypass}&x-vercel-set-bypass-cookie=samesitenone`;
+};
+var getIframeUrl = (path = "") => {
+  if (process.env.NEXT_PUBLIC_VERCEL_ENV === "preview" && process.env.NEXT_PUBLIC_VERCEL_BRANCH_URL) {
+    const vercelUrl = process.env.NEXT_PUBLIC_VERCEL_BRANCH_URL.replace(
+      /^https?:\/\//,
+      ""
+    ).replace(/\/$/, "");
+    const iframeProjectName = process.env.NEXT_PUBLIC_MOONKEY_IFRAME_PROJECT_NAME || DEFAULT_IFRAME_PROJECT_NAME;
+    const iframeUrl = /-git-/.test(vercelUrl) ? vercelUrl.replace(/^[^.]+?-git-/, `${iframeProjectName}-git-`) : (
+      // Fallback: legacy `{prefix}-{hash}.vercel.app` style
+      vercelUrl.replace(/^[^-]+-/, `${iframeProjectName}-`)
+    );
+    return withBypass(joinUrl(`https://${iframeUrl}`, path));
+  }
+  if (process.env.NEXT_PUBLIC_MOONKEY_IFRAME_URL) {
+    return joinUrl(process.env.NEXT_PUBLIC_MOONKEY_IFRAME_URL, path);
+  }
+  return joinUrl("https://iframe.moonx-dev.com", path);
+};
+var getIframeOrigin = (url) => {
+  try {
+    const urlObj = new URL(url);
+    return urlObj.origin;
+  } catch (error) {
+    console.error("Invalid URL:", url);
+    return "";
+  }
+};
+
+// src/utils/post-message.ts
+var FORWARDED_ERROR_FIELDS = [
+  "error_type",
+  "error_code",
+  "status_code"
+];
+var generateUUID = () => {
+  if (typeof crypto !== "undefined" && crypto.randomUUID) {
+    return crypto.randomUUID();
+  }
+  return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
+    const r = Math.random() * 16 | 0;
+    const v = c === "x" ? r : r & 3 | 8;
+    return v.toString(16);
+  });
+};
+var PostMessageType = {
+  AUTH: "auth",
+  INIT: "init",
+  WALLET: "wallet",
+  EXTERNAL_WALLET: "external_wallet"
+};
+var PostMessageMethod = {
+  CLOSE: "CLOSE",
+  CREATE_WALLET: "CREATE_WALLET",
+  IMPORT_KEY: "IMPORT_KEY",
+  FUND_WALLET: "FUND_WALLET",
+  GET_APP_CONFIG: "GET_APP_CONFIG",
+  GET_BALANCE: "GET_BALANCE",
+  GET_CONFIRM_TRANSACTION: "GET_CONFIRM_TRANSACTION",
+  GET_CONFIRM_ETHEREUM_TRANSACTION: "GET_CONFIRM_ETHEREUM_TRANSACTION",
+  GET_CURRENT_SESSION: "GET_CURRENT_SESSION",
+  GET_TOKEN_ACCOUNTS_BY_OWNER: "GET_TOKEN_ACCOUNTS_BY_OWNER",
+  GET_USER: "GET_USER",
+  GET_WALLET: "GET_WALLET",
+  GET_WALLETS: "GET_WALLETS",
+  IS_AUTHENTICATED: "IS_AUTHENTICATED",
+  LOGIN_CREATE: "LOGIN_CREATE",
+  LOGOUT: "LOGOUT",
+  PREFETCH_CAPTCHA: "PREFETCH_CAPTCHA",
+  READY: "READY",
+  SEND_TRANSACTION: "SEND_TRANSACTION",
+  SIGN_MESSAGE: "SIGN_MESSAGE",
+  SIGN_TRANSACTION: "SIGN_TRANSACTION",
+  SIGN_TYPED_DATA: "SIGN_TYPED_DATA",
+  // Sign a pre-computed 32-byte digest as ECDSA. Caller-supplied hash
+  // — no EIP-191 prefix, no tx parsing, no domain separator. Useful
+  // for ZK circuits / custom auth flows / anywhere the digest is
+  // computed externally. Mirrors Privy's `secp256k1_sign` provider
+  // method but exposed as its own postMessage to keep the iframe
+  // dispatcher boring.
+  SIGN_HASH: "SIGN_HASH",
+  SIGN_7702_AUTHORIZATION: "SIGN_7702_AUTHORIZATION",
+  VERIFY_EMAIL_OTP: "VERIFY_EMAIL_OTP",
+  VERIFY_OAUTH: "VERIFY_OAUTH",
+  START_OAUTH: "START_OAUTH",
+  WALLET_REGISTRATION_NONCE: "WALLET_REGISTRATION_NONCE",
+  VERIFY_SIWE_WALLET_REGISTRATION: "VERIFY_SIWE_WALLET_REGISTRATION",
+  ATTACH_OAUTH: "ATTACH_OAUTH",
+  DETACH_OAUTH: "DETACH_OAUTH",
+  // Passkey as a post-identity enrollment / unlock ceremony. The two
+  // methods below split the ceremony so the parent owns the WebAuthn
+  // API call (where user activation lives) and the iframe owns the
+  // begin/verify HTTP calls (where the session JWT lives).
+  PASSKEY_REGISTER_BEGIN: "PASSKEY_REGISTER_BEGIN",
+  PASSKEY_REGISTER_VERIFY: "PASSKEY_REGISTER_VERIFY",
+  GET_PASSKEY_STATUS: "GET_PASSKEY_STATUS",
+  // Parent-side passkey assertion plumbing. Parent calls GET_DEK_INFO
+  // to learn which credential IDs to put in allowCredentials and to
+  // know whether bootstrap-vs-unwrap path applies, then runs
+  // navigator.credentials.get itself (where iframe-cross-origin
+  // activation rules don't bite). Wallet-op postMessages then carry
+  // the resulting user_handle_b64url + credential_id_b64url back into
+  // the iframe so encrypted-keyshare helpers can unwrap the DEK.
+  GET_DEK_INFO: "GET_DEK_INFO",
+  // Multi-passkey management on an existing user. ADD_PASSKEY_WRAP is
+  // the iframe half of the parent-driven add-passkey flow: parent runs
+  // both WebAuthn ceremonies (assert old credential, register new
+  // credential), then posts the two resulting (userHandle, credId)
+  // pairs here so the iframe can unlock the DEK with the old
+  // credential and seal a new wrap with the new credential.
+  ADD_PASSKEY_WRAP: "ADD_PASSKEY_WRAP",
+  REMOVE_PASSKEY: "REMOVE_PASSKEY"
+};
+var PostMessageClient = class {
+  constructor(target, origin = "*") {
+    this.target = target;
+    this.origin = origin;
+  }
+  async send(type, method, payload) {
+    const id = generateUUID();
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        window.removeEventListener("message", handler);
+        reject(new Error("Timeout: No response from iframe"));
+      }, 3e4);
+      const handler = (event) => {
+        if (this.origin !== "*" && event.origin !== this.origin) {
+          return;
+        }
+        const response = event.data;
+        if (response.id === id) {
+          clearTimeout(timeout);
+          window.removeEventListener("message", handler);
+          if (response.success) {
+            resolve(response.data);
+          } else {
+            const err = new Error(response.error);
+            for (const key of FORWARDED_ERROR_FIELDS) {
+              const value = response[key];
+              if (value !== void 0) {
+                err[key] = value;
+              }
+            }
+            reject(err);
+          }
+        }
+      };
+      window.addEventListener("message", handler);
+      this.target.postMessage(
+        {
+          id,
+          type,
+          method,
+          payload
+        },
+        this.origin
+      );
+    });
+  }
+  async sendOneWay(type, method, payload) {
+    const id = generateUUID();
+    const envelope = {
+      id,
+      type,
+      method,
+      payload
+    };
+    if (typeof window !== "undefined" && typeof window.ReactNativeWebView !== "undefined") {
+      try {
+        window.ReactNativeWebView.postMessage(JSON.stringify(envelope));
+      } catch {
+      }
+      return;
+    }
+    this.target.postMessage(envelope, this.origin);
+  }
+};
+var isReactNativeWebView = () => typeof window !== "undefined" && typeof window.ReactNativeWebView !== "undefined";
+var sendReactNativeReply = (response) => {
+  try {
+    window.ReactNativeWebView.postMessage(JSON.stringify(response));
+  } catch {
+  }
+};
+var PostMessageServer = class {
+  constructor(originValidator) {
+    this.trustedSources = /* @__PURE__ */ new Set();
+    this.handlers = /* @__PURE__ */ new Map();
+    this.originValidator = originValidator;
+    window.addEventListener("message", this.handleMessage.bind(this));
+  }
+  addTrustedSource(source) {
+    this.trustedSources.add(source);
+  }
+  removeTrustedSource(source) {
+    this.trustedSources.delete(source);
+  }
+  register(type, method, handler) {
+    const key = `${type}:${method}`;
+    this.handlers.set(key, handler);
+  }
+  cleanup() {
+    window.removeEventListener("message", this.handleMessage.bind(this));
+    this.handlers.clear();
+  }
+  static isLocalhostOrigin(origin) {
+    try {
+      const url = new URL(origin);
+      return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    } catch {
+      return false;
+    }
+  }
+  isValidPostMessageRequest(data) {
+    return data && typeof data === "object" && typeof data.id === "string" && typeof data.type === "string" && typeof data.method === "string";
+  }
+  async handleMessage(event) {
+    if (!this.isValidPostMessageRequest(event.data)) {
+      return;
+    }
+    if (!event.origin || event.origin === "null") {
+      console.error("[PostMessageServer] Invalid or null origin received");
+      return;
+    }
+    const request = event.data;
+    const rnMode = isReactNativeWebView();
+    const reply = (response) => {
+      if (rnMode) {
+        sendReactNativeReply(response);
+        return;
+      }
+      if (event.source && event.origin) {
+        event.source.postMessage(response, { targetOrigin: event.origin });
+      }
+    };
+    if (this.originValidator && !rnMode) {
+      const publishableKey = request.payload?.publishableKey;
+      try {
+        const isAllowed = await this.originValidator(
+          event.origin,
+          publishableKey
+        );
+        if (!isAllowed) {
+          reply({
+            id: request.id,
+            type: request.type,
+            success: false,
+            error: `Origin ${event.origin} is not whitelisted. Please add it to your MoonKey dashboard.`
+          });
+          return;
+        }
+      } catch (error) {
+        reply({
+          id: request.id,
+          type: request.type,
+          success: false,
+          error: "Origin validation failed"
+        });
+        return;
+      }
+    }
+    const key = `${request.type}:${request.method}`;
+    const handler = this.handlers.get(key);
+    if (handler) {
+      try {
+        const data = await handler(request.payload);
+        reply({
+          id: request.id,
+          type: request.type,
+          success: true,
+          data
+        });
+      } catch (error) {
+        const extras = {};
+        if (error && typeof error === "object") {
+          for (const key2 of FORWARDED_ERROR_FIELDS) {
+            const value = error[key2];
+            if (value !== void 0) extras[key2] = value;
+          }
+        }
+        reply({
+          ...extras,
+          id: request.id,
+          type: request.type,
+          success: false,
+          error: error instanceof Error ? error.message : "Unknown error"
+        });
+      }
+    }
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  FORWARDED_ERROR_FIELDS,
+  Network,
+  PostMessageClient,
+  PostMessageMethod,
+  PostMessageServer,
+  PostMessageType,
+  WALLET_ERROR_CODES,
+  WalletCreationError,
+  getIframeOrigin,
+  getIframeUrl,
+  getMoonKeyApiUrl
+});

package/dist/index.mjs

@@ -0,0 +1,33 @@
+import {
+  Network,
+  WALLET_ERROR_CODES,
+  WalletCreationError
+} from "./chunk-IMLBIIJ4.mjs";
+import "./chunk-CMYR6AOY.mjs";
+import {
+  getIframeOrigin,
+  getIframeUrl
+} from "./chunk-264CEGDS.mjs";
+import {
+  FORWARDED_ERROR_FIELDS,
+  PostMessageClient,
+  PostMessageMethod,
+  PostMessageServer,
+  PostMessageType
+} from "./chunk-SOKLPX7V.mjs";
+import {
+  getMoonKeyApiUrl
+} from "./chunk-GQKIA37O.mjs";
+export {
+  FORWARDED_ERROR_FIELDS,
+  Network,
+  PostMessageClient,
+  PostMessageMethod,
+  PostMessageServer,
+  PostMessageType,
+  WALLET_ERROR_CODES,
+  WalletCreationError,
+  getIframeOrigin,
+  getIframeUrl,
+  getMoonKeyApiUrl
+};

package/dist/interfaces-9k0eKCc4.d.ts

@@ -0,0 +1,120 @@
+import { c as PostMessageType, a as PostMessageMethod } from './post-message-C_99BCBh.js';
+
+/**
+ * Transport — the bidirectional postMessage channel between the parent
+ * (web SDK or RN SDK) and the iframe-app. Web wraps
+ * `createPostMessageClient(iframeRef.current.contentWindow, ...)`; RN
+ * wraps a `WebViewBridge` over react-native-webview.
+ *
+ * `send` resolves with the iframe handler's raw return value and rejects
+ * with the handler's thrown error (canonical envelope, no
+ * {success, data} unwrap at the call site).
+ */
+interface Transport {
+    send<P, R>(type: PostMessageType, method: PostMessageMethod, payload: P): Promise<R>;
+    /**
+     * Register a handler for inbound messages from the iframe-app. Only
+     * needed by the parent-side `*WithUI` flow path, where the modal
+     * postMessages a result back that the SDK's pending Promise needs to
+     * resolve. Returns an unregister fn.
+     */
+    register?<P, R>(type: PostMessageType, method: PostMessageMethod, handler: (payload: P) => Promise<R> | R): () => void;
+    /**
+     * Whether the underlying iframe / WebView is loaded and ready to
+     * receive messages. SDK methods short-circuit with "SDK not ready"
+     * before calling `send` if this returns false.
+     */
+    isReady(): boolean;
+}
+/**
+ * PasskeyAssertor — runs the WebAuthn ceremony in the *parent* (where
+ * user activation lives — cross-origin iframes/WebViews can't reliably
+ * get their own click handler).
+ *
+ * Both `assert` and `create` use empty `allowCredentials` on the
+ * underlying API to force the discoverable-login codepath where
+ * userHandle is REQUIRED. The userHandle bytes are the wrap key the
+ * iframe-app uses to unwrap the DEK before signing.
+ */
+interface PasskeyAssertor {
+    /**
+     * Run a WebAuthn assertion (`navigator.credentials.get` on web,
+     * `passkeyGet` from react-native-passkeys on RN). Returns the
+     * platform-decoded base64url forms of the credential id and userHandle.
+     */
+    assert(opts: {
+        rpId: string;
+        challenge: string;
+        /**
+         * The wire `allow_credential_ids_b64url` list from GET_DEK_INFO,
+         * passed through for platforms that want to use it. Note both
+         * platforms today pass an empty array to the underlying API; this
+         * field is informational only (e.g. for telemetry or for a future
+         * platform that prefers non-discoverable login).
+         */
+        allowCredentials: string[];
+    }): Promise<{
+        rawIdB64url: string;
+        userHandleB64url: string;
+    }>;
+    /**
+     * Run a WebAuthn registration (`navigator.credentials.create` on web,
+     * `passkeyCreate` from react-native-passkeys on RN). Used by passkey
+     * register flows.
+     */
+    create(opts: {
+        rpId: string;
+        rpName: string;
+        userId: Uint8Array;
+        userName: string;
+        userDisplayName: string;
+        challenge: string;
+        excludeCredentials?: string[];
+    }): Promise<{
+        rawIdB64url: string;
+        clientDataJSONB64url: string;
+        attestationObjectB64url: string;
+    }>;
+}
+/**
+ * KvStorage — async key/value storage for ID tokens + session metadata.
+ * Web wraps `localStorage` (sync, lifted to a resolved Promise); RN
+ * wraps `@react-native-async-storage/async-storage` (natively async).
+ *
+ * Always async at the interface to unify both platforms.
+ */
+interface KvStorage {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    remove(key: string): Promise<void>;
+}
+/**
+ * OAuthOpener — start an OAuth authorize request and wait for the
+ * provider redirect to return with `code` + `state`. Web uses a
+ * full-page redirect or popup (completion picked up by
+ * `useOAuthCompletion` listening for postMessages); RN uses
+ * `expo-web-browser.openAuthSessionAsync` (single Promise resolves on
+ * deep-link callback).
+ */
+interface OAuthOpener {
+    open(opts: {
+        authorizeUrl: string;
+        redirectUrl: string;
+    }): Promise<{
+        code: string;
+        state: string;
+    }>;
+}
+/**
+ * The bundle of platform impls that the SDK factories accept. Provider
+ * components on each platform construct one of these once and pass it
+ * through to the factories.
+ */
+interface PlatformImpls {
+    transport: Transport;
+    passkey: PasskeyAssertor;
+    storage: KvStorage;
+    oauth: OAuthOpener;
+}
+
+export type { KvStorage as K, OAuthOpener as O, PasskeyAssertor as P, Transport as T, PlatformImpls as a };

package/dist/interfaces-fNhwnCeY.d.mts

@@ -0,0 +1,120 @@
+import { c as PostMessageType, a as PostMessageMethod } from './post-message-C_99BCBh.mjs';
+
+/**
+ * Transport — the bidirectional postMessage channel between the parent
+ * (web SDK or RN SDK) and the iframe-app. Web wraps
+ * `createPostMessageClient(iframeRef.current.contentWindow, ...)`; RN
+ * wraps a `WebViewBridge` over react-native-webview.
+ *
+ * `send` resolves with the iframe handler's raw return value and rejects
+ * with the handler's thrown error (canonical envelope, no
+ * {success, data} unwrap at the call site).
+ */
+interface Transport {
+    send<P, R>(type: PostMessageType, method: PostMessageMethod, payload: P): Promise<R>;
+    /**
+     * Register a handler for inbound messages from the iframe-app. Only
+     * needed by the parent-side `*WithUI` flow path, where the modal
+     * postMessages a result back that the SDK's pending Promise needs to
+     * resolve. Returns an unregister fn.
+     */
+    register?<P, R>(type: PostMessageType, method: PostMessageMethod, handler: (payload: P) => Promise<R> | R): () => void;
+    /**
+     * Whether the underlying iframe / WebView is loaded and ready to
+     * receive messages. SDK methods short-circuit with "SDK not ready"
+     * before calling `send` if this returns false.
+     */
+    isReady(): boolean;
+}
+/**
+ * PasskeyAssertor — runs the WebAuthn ceremony in the *parent* (where
+ * user activation lives — cross-origin iframes/WebViews can't reliably
+ * get their own click handler).
+ *
+ * Both `assert` and `create` use empty `allowCredentials` on the
+ * underlying API to force the discoverable-login codepath where
+ * userHandle is REQUIRED. The userHandle bytes are the wrap key the
+ * iframe-app uses to unwrap the DEK before signing.
+ */
+interface PasskeyAssertor {
+    /**
+     * Run a WebAuthn assertion (`navigator.credentials.get` on web,
+     * `passkeyGet` from react-native-passkeys on RN). Returns the
+     * platform-decoded base64url forms of the credential id and userHandle.
+     */
+    assert(opts: {
+        rpId: string;
+        challenge: string;
+        /**
+         * The wire `allow_credential_ids_b64url` list from GET_DEK_INFO,
+         * passed through for platforms that want to use it. Note both
+         * platforms today pass an empty array to the underlying API; this
+         * field is informational only (e.g. for telemetry or for a future
+         * platform that prefers non-discoverable login).
+         */
+        allowCredentials: string[];
+    }): Promise<{
+        rawIdB64url: string;
+        userHandleB64url: string;
+    }>;
+    /**
+     * Run a WebAuthn registration (`navigator.credentials.create` on web,
+     * `passkeyCreate` from react-native-passkeys on RN). Used by passkey
+     * register flows.
+     */
+    create(opts: {
+        rpId: string;
+        rpName: string;
+        userId: Uint8Array;
+        userName: string;
+        userDisplayName: string;
+        challenge: string;
+        excludeCredentials?: string[];
+    }): Promise<{
+        rawIdB64url: string;
+        clientDataJSONB64url: string;
+        attestationObjectB64url: string;
+    }>;
+}
+/**
+ * KvStorage — async key/value storage for ID tokens + session metadata.
+ * Web wraps `localStorage` (sync, lifted to a resolved Promise); RN
+ * wraps `@react-native-async-storage/async-storage` (natively async).
+ *
+ * Always async at the interface to unify both platforms.
+ */
+interface KvStorage {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    remove(key: string): Promise<void>;
+}
+/**
+ * OAuthOpener — start an OAuth authorize request and wait for the
+ * provider redirect to return with `code` + `state`. Web uses a
+ * full-page redirect or popup (completion picked up by
+ * `useOAuthCompletion` listening for postMessages); RN uses
+ * `expo-web-browser.openAuthSessionAsync` (single Promise resolves on
+ * deep-link callback).
+ */
+interface OAuthOpener {
+    open(opts: {
+        authorizeUrl: string;
+        redirectUrl: string;
+    }): Promise<{
+        code: string;
+        state: string;
+    }>;
+}
+/**
+ * The bundle of platform impls that the SDK factories accept. Provider
+ * components on each platform construct one of these once and pass it
+ * through to the factories.
+ */
+interface PlatformImpls {
+    transport: Transport;
+    passkey: PasskeyAssertor;
+    storage: KvStorage;
+    oauth: OAuthOpener;
+}
+
+export type { KvStorage as K, OAuthOpener as O, PasskeyAssertor as P, Transport as T, PlatformImpls as a };